Static task
static1
Behavioral task
behavioral1
Sample
2ef752678d9ae4c64f6e2dafb6925043838dd8adad7749c89f9de80cc48c810e.exe
Resource
win7-20221111-en
General
-
Target
2ef752678d9ae4c64f6e2dafb6925043838dd8adad7749c89f9de80cc48c810e
-
Size
323KB
-
MD5
1ebc776ae428288cb8a5164aab243275
-
SHA1
6a48a6b16898f01a386815270061d8197d67c678
-
SHA256
2ef752678d9ae4c64f6e2dafb6925043838dd8adad7749c89f9de80cc48c810e
-
SHA512
01b2bea419384fe078ff8583f7b6a1b98f4639cbda747bb7ca74ade294e0b392297ec713667ddc23d341f2fbd3879369a096f25635e651935276d66d6f93a1a3
-
SSDEEP
6144:rVkEHojxNSWY4JXXp2zq/mpnUbC44fyMSN+0S:rV8jxUWXXMm/mpszEyMSN+0
Malware Config
Signatures
Files
-
2ef752678d9ae4c64f6e2dafb6925043838dd8adad7749c89f9de80cc48c810e.exe windows x86
acda194c03c33c6da26f7f4dd2e97e63
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FlushConsoleInputBuffer
advapi32
DecryptFileA
mpr
WNetCancelConnection2A
WNetGetNetworkInformationW
WNetCancelConnectionA
WNetGetProviderNameW
WNetAddConnectionA
MultinetGetConnectionPerformanceA
WNetAddConnection2A
WNetConnectionDialog1W
WNetGetUserA
user32
GetMenuStringW
GetClassInfoExA
EnumDesktopWindows
CallMsgFilterA
DdeNameService
GetMenu
SetWindowsHookExA
SendMessageCallbackW
UnhookWindowsHookEx
SetWindowPos
DefWindowProcA
DdeAccessData
IsCharLowerW
SetWindowRgn
DrawEdge
msi
ord25
ord11
ord49
ord60
ord56
ord64
ord37
ord28
ord16
ord46
ord54
msvcrt
_except_handler3
setupapi
SetupCloseLog
shell32
ShellAboutA
ShellExecuteA
SHBrowseForFolderA
SHGetSpecialFolderPathA
ShellExecuteExA
ExtractIconExA
ShellExecuteW
oleaut32
VarBstrFromUI4
RegisterActiveObject
VarBoolFromUI1
VarCyFromDec
CreateTypeLib2
BSTR_UserFree
lz32
LZDone
rpcrt4
NdrEncapsulatedUnionMarshall
RpcSmFree
MesIncrementalHandleReset
tree_peek_ndr
RpcSsDontSerializeContext
NDRSContextUnmarshall
RpcAsyncInitializeHandle
float_array_from_ndr
RpcProtseqVectorFreeW
RpcServerTestCancel
NdrServerInitializeUnmarshall
I_RpcSend
I_RpcBindingIsClientLocal
data_into_ndr
NdrPointerBufferSize
NdrRpcSsDefaultFree
NdrClientContextUnmarshall
RpcSsGetThreadHandle
RpcMgmtIsServerListening
NDRcopy
UuidToStringA
NdrAllocate
NdrServerMarshall
UuidCompare
I_RpcIfInqTransferSyntaxes
NdrNonEncapsulatedUnionFree
NdrServerInitializePartial
NdrConformantStringUnmarshall
RpcBindingSetAuthInfoA
NdrByteCountPointerMarshall
NDRCContextBinding
NdrFullPointerQueryRefId
NdrUserMarshalFree
RpcBindingInqAuthClientA
RpcBindingSetAuthInfoExW
RpcCancelThread
RpcEpRegisterNoReplaceW
RpcBindingServerFromClient
RpcMgmtWaitServerListen
RpcEpRegisterW
NdrConformantVaryingArrayUnmarshall
I_RpcNsBindingSetEntryNameW
RpcSsSetClientAllocFree
RpcServerUseProtseqExA
NdrGetDcomProtocolVersion
RpcAsyncCancelCall
NdrEncapsulatedUnionBufferSize
NdrRpcSmClientFree
NdrComplexStructMarshall
MIDL_wchar_strlen
IUnknown_Release_Proxy
NdrConformantVaryingStructFree
MesInqProcEncodingId
NdrSimpleTypeUnmarshall
RpcBindingFree
RpcMgmtStopServerListening
NdrFixedArrayMemorySize
NdrFullPointerXlatInit
NdrComplexStructUnmarshall
NdrStubCall
IUnknown_AddRef_Proxy
RpcBindingInqAuthInfoW
RpcEpResolveBinding
NdrEncapsulatedUnionUnmarshall
I_RpcPauseExecution
RpcMgmtStatsVectorFree
NdrComplexArrayMemorySize
I_RpcAsyncAbortCall
NdrComplexArrayBufferSize
RpcIfInqId
NdrRpcSsDisableAllocate
RpcMgmtEnableIdleCleanup
NdrPointerUnmarshall
NdrConformantArrayMemorySize
I_RpcBindingCopy
RpcServerUseAllProtseqsIf
RpcServerUseProtseqIfW
RpcMgmtInqStats
RpcObjectSetInqFn
NdrNonEncapsulatedUnionMemorySize
RpcEpUnregister
NdrFixedArrayFree
RpcServerUseAllProtseqsEx
UuidEqual
NdrFullPointerXlatFree
RpcRevertToSelf
RpcSmDisableAllocate
I_RpcBindingInqTransportType
RpcMgmtInqDefaultProtectLevel
NdrNonEncapsulatedUnionMarshall
NdrClientInitializeNew
RpcServerRegisterAuthInfoA
I_RpcRequestMutex
MesEncodeDynBufferHandleCreate
RpcServerUseProtseqA
long_array_from_ndr
NdrServerUnmarshall
NdrServerInitialize
NdrClearOutParameters
NdrUserMarshalBufferSize
NdrXmitOrRepAsBufferSize
RpcBindingVectorFree
NdrOleFree
NdrInterfacePointerMemorySize
long_from_ndr_temp
RpcServerRegisterIfEx
data_size_ndr
NdrRpcSmSetClientToOsf
short_from_ndr_temp
I_RpcSendReceive
NdrConformantVaryingStructMarshall
NdrRpcSsDefaultAllocate
NdrVaryingArrayUnmarshall
RpcBindingToStringBindingW
NdrSimpleStructMarshall
RpcMgmtInqServerPrincNameA
RpcRevertToSelfEx
NdrServerInitializeMarshall
RpcSmAllocate
NdrRpcSsEnableAllocate
UuidToStringW
NdrSendReceive
IUnknown_QueryInterface_Proxy
double_array_from_ndr
RpcBindingCopy
RpcAsyncAbortCall
NdrConformantVaryingStructBufferSize
RpcMgmtEpEltInqNextA
RpcSsDisableAllocate
RpcMgmtSetComTimeout
NDRSContextUnmarshallEx
NdrUserMarshalSimpleTypeConvert
NdrServerContextUnmarshall
RpcBindingInqAuthInfoA
double_from_ndr
DceErrorInqTextA
RpcSmClientFree
MesEncodeIncrementalHandleCreate
NdrConformantStructMemorySize
RpcBindingFromStringBindingW
RpcBindingInqAuthClientW
I_RpcSsDontSerializeContext
I_UuidCreate
NdrConvert2
RpcRaiseException
NdrByteCountPointerFree
NdrPointerMemorySize
UuidCreateNil
NdrRpcSmClientAllocate
RpcEpRegisterA
I_RpcAsyncSetHandle
RpcMgmtEpEltInqNextW
NdrXmitOrRepAsUnmarshall
NdrNonEncapsulatedUnionBufferSize
short_from_ndr
RpcBindingReset
I_RpcServerInqTransportType
NdrConformantArrayFree
NdrConvert
MesEncodeFixedBufferHandleCreate
char_from_ndr
RpcMgmtEpEltInqDone
NdrComplexStructMemorySize
NdrServerInitializeNew
data_from_ndr
RpcServerInqIf
RpcBindingInqAuthInfoExA
NdrNonConformantStringMarshall
RpcNsBindingInqEntryNameA
NdrClientContextMarshall
I_RpcGetCurrentCallHandle
NdrConformantVaryingStructUnmarshall
NdrMesTypeEncode
NdrConformantStringBufferSize
I_RpcBindingInqDynamicEndpointW
RpcSsDestroyClientContext
I_RpcNsBindingSetEntryNameA
NdrGetBuffer
NdrPointerMarshall
NdrServerCall
NdrComplexStructFree
UuidFromStringA
char_array_from_ndr
I_RpcBindingInqDynamicEndpointA
RpcSmDestroyClientContext
RpcProtseqVectorFreeA
DceErrorInqTextW
NdrComplexArrayUnmarshall
RpcServerUseProtseqIfExW
RpcMgmtEpUnregister
RpcServerUseProtseqIfExA
RpcMgmtInqIfIds
RpcNetworkIsProtseqValidW
NdrConformantStructFree
I_RpcFreePipeBuffer
RpcNetworkInqProtseqsW
NdrConformantVaryingArrayMarshall
NdrMesSimpleTypeDecode
I_RpcConnectionSetSockBuffSize
NdrByteCountPointerBufferSize
NdrVaryingArrayFree
NDRSContextMarshall
UuidFromStringW
NdrFreeBuffer
RpcEpRegisterNoReplaceA
RpcAsyncGetCallStatus
RpcServerUseProtseqEpW
RpcBindingInqOption
RpcMgmtSetCancelTimeout
NdrFixedArrayMarshall
NdrSimpleTypeMarshall
NdrFullPointerFree
RpcBindingInqObject
RpcServerInqBindings
NdrSimpleStructFree
NdrComplexArrayMarshall
UuidHash
comctl32
ImageList_DrawEx
ole32
CreateAntiMoniker
CoUnmarshalHresult
CoGetMalloc
CoRegisterSurrogate
CoRevokeMallocSpy
CoIsHandlerConnected
OleIsRunning
CoSuspendClassObjects
CoUninitialize
CoRegisterMessageFilter
CoFreeUnusedLibraries
HMENU_UserUnmarshal
OleNoteObjectVisible
GetHGlobalFromStream
StgOpenPropStg
OleLoadFromStream
OleFlushClipboard
CoRevokeClassObject
OleCreateStaticFromData
GetClassFile
HACCEL_UserUnmarshal
CoGetStdMarshalEx
CreateOleAdviseHolder
HPALETTE_UserSize
GetConvertStg
CoRegisterMallocSpy
OleCreateEmbeddingHelper
OleCreateFromDataEx
StgIsStorageFile
CoGetMarshalSizeMax
OleRegEnumFormatEtc
FreePropVariantArray
CoTaskMemFree
OleQueryLinkFromData
OleCreateFromData
HMENU_UserFree
OleCreateMenuDescriptor
imm32
ImmSetCompositionStringA
gdi32
SetMapMode
GetTextColor
EnumFontFamiliesW
GetOutlineTextMetricsW
CreateDiscardableBitmap
CreatePatternBrush
StartPage
GetEnhMetaFileDescriptionA
GetArcDirection
DeleteDC
CreatePalette
SetTextAlign
PtVisible
PolyPolygon
Sections
.text Size: 60KB - Virtual size: 57KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 984KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ